http://coldfusion.com logo
Join Slack
Powered by
Is there a way to update some of the individual pa...
# box-products
j
Is there a way to update some of the individual packages located in the bundle 
root/.CommandBox/lib/runwar-4.7.7.jar
? This is box-light by the way. In my Lucee hardening adventure, the last two items striking some red flags are 
io.undertow:undertow-core
and 
net.minidev:json-smart-mini
both of which are showing up as included in that .jar file.
b
@Jason Ryan Are you on the lastest CommandBox because I just updated those libraries this week in the 5.6 release
j
@bdw429s Just updated to 5.6.1 and it appears that 
io.undertow:undertow-core
remains unchanged in its vulnerability status. But 
net.minidev:json-smart-mini
is slightly different - This one no longer shows up under 
runwar-4.7.7.jar
but it does come up under 
/root/.CommandBox/lib/json-smart-mini-1.0.8.jar
Curious what happens if I delete that 
.jar
🤔
b
@Jason Ryan What version of runwar do you have?
j
Oh man I just realized I'm still installing the old version. That probably explains everything
My bad 😞
b
Yeah,, you should be on RUnwar 4.7.14
I've bumped all the runwar java dependencies in last week's version
With the exception of JBoss logging which I could only update to 3.4.4 as 3.5.0 has dropped Java 8 compat
j
Or possibly that's the max version that has the vulnerability
b
What's the CVE?
There may have been something that came out that isn't fixed yet
But I don't think I don't control the XNIO version-- Undertow bundles that
j
CVE-2022-0084
A flaw was found in XNIO, specifically in the notifyReadClosed method. The issue revealed this method was logging a message to another expected end. This flaw allows an attacker to send flawed requests to a server, possibly causing log contention-related performance concerns or an unwanted disk fill-up.
b
7.5 seems unnecessarily high for something that just creates log entries 🤔
All of CommandBox's logs automatically do rotation so that's not really a concern
j
Good to know!
b
Plus, I'm 99% sure the XNIO logs aren't even directed anywhere unless they are errors
Yeah, 
3.8.7
is the current stable release of XNIO
There's no fix yet for that CVE
So there's no way to upgrade it 🙂
j
Gotcha. We can live with that 😄
b
But I would say the exploitable area exposed by CommandBox would be very low or non-existent
j
Right on 👍
b
Pete pointed out this one to me the other day, and I am already planning on releasing as soon as there are any security fixes
j
You da man!
b
👍 Thanks for checking!
j
Hey man glad I was able to help a bit 🙂
Open in Slack
PreviousNext
Powered by